Two hundred accounts were on Alex Hern’s list – on a placeholder account with unused email address.
Photograph: Dado Ruvic/Reuters

On one of Facebook’s myriad setting screens, a place where few dare tread, is a list of places you’ve probably never heard of, all of whom insist that they know you. It’s emblematic of the data protection issues Facebook is struggling to address in the wake of the Cambridge Analytica scandal, of the fact that these problems spread far beyond Facebook, and of the easy solutions the company could take if only it had the courage.

This list is the collection of “advertisers you’ve interacted with”. You can find it halfway down your ad preferences screen, below a list of algorithmically suggested topics that Facebook thinks you’re interested in (if you’re a heavy user, these may be scarily accurate; if you’re not, they’ll likely be hilariously off).

A layperson may think the list of advertisers you’ve interacted with contains… advertisers you’ve interacted with. And some sub-sections do. The tab “whose website or app you’ve used” is self-explanatory – if you’ve logged in to a website or app through Facebook, well, that company knows who you are and can now advertise to you. The same is true if you visit a website that has Facebook’s tracking pixel on it (the “who you’ve visited” list) or, most obviously, if you’ve already clicked on an ad before (“whose ads you’ve clicked”).

A smattering of the businesses who have Alex Hern’s email address. Photograph: Facebook

But the largest list is titled “who have added their contact list to Facebook”. And for me it’s a long list of companies you have never done business with, interacted with – or even knew existed.

My list – on a placeholder Facebook account with no friends, created using an email address I don’t hand out for mailing lists – contained almost 200 advertisers, including an Italian restaurant in Perth, Australia; a waffle shop in Charlottenburg, Germany; and a surf cafe in Dubai.

Facebook’s explanation for the list is simple enough: “These advertisers are running ads using a contact list they uploaded that includes your contact information,” the company tells users. “This information was collected by the advertiser, likely after you shared your email address with them or another business they’ve partnered with.”

Advertisers are not allowed to simply buy a list of email addresses and upload them, or harvest them from the internet and sign people up to their mailing lists without consent. That is not only against most nations’ data protection laws, it is also against Facebook’s terms of service, which require that advertisers “have provided appropriate notice to and secured any necessary consent from the data subjects”.

Yet those terms of service have not stopped just that from happening. The lure of extending your targeted advertising just a little bit further is just too strong. Shady data brokers will happily sell you a list of email addresses perfectly profiled for your restaurant to advertise to, and if you do not want to pay, well you can just jump on the dark web and download millions from one of the large dumps made public over the past decade.

That’s not to say I am powerless. Facebook provides me with the ability to opt out of advertising from those companies, just by clicking a cross in the corner. All I need to do is devote some time to clicking a small button 174 times in a row and I am free from those companies – at least until the next 174 decide to upload my information.

What I cannot do is anything with real power. I cannot tell Facebook that the vast majority of these companies cannot possibly have acquired my email address legitimately; I cannot opt out of them all at once, defenestrating advertisers in their masses with a single click; and I certainly cannot request that no company be able to target me simply by uploading an easily guessable address to the site.

When it rolled out its new privacy policies in advance of GDPR, Facebook stood fast against some observers who believe complying with the law requires offering the option to opt out of targeted advertising altogether. Instead, the company took a slimmed-down approach, allowing users to limit the kinds of data that advertisers can target with, but insisting that targeting overall was fine.

It may still be. But I’m not sure many users will take a look at the state of targeted advertising today, as reflected on their own Facebook settings pages, and conclude that everything is working as it should.